Examkin

Question

Difficulty: HardCommon Network Attack Types and Vectors

During a security audit, a network analyst discovers that a host connected to an access port on VLAN 10 successfully transmitted unauthorized frames directly to a critical server on VLAN 30 without passing through an inter-VLAN routing firewall. The two hosts reside on separate switches connected by an 802.1Q trunk link, where VLAN 10 is designated as the native VLAN. Which of the following statements correctly identify the mechanism behind this security breach and the appropriate remediation step? (Select TWO.)

  1. The attacker crafted frames with dual 802.1Q tags; the first switch stripped the outer tag matching its native VLAN and forwarded the frame with the inner target tag across the trunk.Answer
  2. The attack can be prevented by reassigning the native VLAN across all trunk links to an unused dummy VLAN ID and explicitly tagging native VLAN traffic.Answer
  3. C
    The attacker sent explicit Dynamic Trunking Protocol (DTP) negotiation frames to force the switch access port into an active trunking operational state.
  4. D
    The vulnerability was caused by a missing AAAA record on the primary DNS server, causing the host to fall back to unencrypted Layer 2 broadcast encapsulation.

Answer

The attack was executed via 802.1Q double tagging, where the first switch stripped the outer native VLAN tag and forwarded the frame with the inner tag intact. The threat is mitigated by changing the native VLAN to an unused dummy VLAN ID across all trunk interfaces.
In an 802.1Q double tagging attack, an attacker sends an Ethernet frame containing two VLAN tags (an outer tag matching the trunk's native VLAN and an inner tag specifying the target destination VLAN). When the first switch receives the frame, it strips the outer native VLAN tag before transmitting the frame over the trunk link. The secondary switch reads the remaining inner tag and delivers the frame to the destination VLAN, bypassing Layer 3 routing and firewall filtering. To remediate this risk, network administrators must configure an unused dummy VLAN ID as the native VLAN across all switch trunk ports so that incoming frames from active access VLANs are never subject to native tag stripping.

Step-by-Step Solution

1
Analyze the reported VLAN traversal anomaly.
Identified 802.1Q Double Tagging (VLAN Hopping) exploitation.
When an attacker's access VLAN matches the native VLAN of an 802.1Q trunk, crafted frames containing two 802.1Q headers will have their outer tag removed by the first switch, allowing the inner tag to dictate destination VLAN delivery on the receiving switch.
2
Evaluate mitigation controls for double tagging vulnerabilities.
Reassign native VLANs to dedicated, unused VLAN IDs.
If no user endpoints reside on the native VLAN, frames arriving from valid host VLANs will always retain explicit tags, preventing unauthorized single-tag stripping over trunk links.

Key Concept

802.1Q Double Tagging Attack and Mitigation
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic